diff --git a/.github/workflows/deploy-cloudflare.yml b/.github/workflows/ci.yml
similarity index 71%
rename from .github/workflows/deploy-cloudflare.yml
rename to .github/workflows/ci.yml
index b905313..eba7d2a 100644
--- a/.github/workflows/deploy-cloudflare.yml
+++ b/.github/workflows/ci.yml
@@ -1,13 +1,22 @@
-name: Deploy to Cloudflare
+name: CI
 
 on:
+  pull_request:
   push:
     branches:
       - main
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
-  deploy:
+  ci:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@v7
@@ -34,9 +43,3 @@ jobs:
 
       - name: Build check
         run: pnpm run build
-
-      - name: Deploy to Cloudflare Worker
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-        run: pnpm run deploy
diff --git a/AGENTS.md b/AGENTS.md
index 9af6732..cf4f5fd 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -17,6 +17,7 @@
 - `docs/ADR-001-architecture.md` records the converter architecture and its rationale.
 - `docs/SPEC-COVERAGE-REPORT.md` is an acceptance-coverage snapshot. Use it as evidence to audit, then verify the live code and tests rather than treating the dated status as authoritative.
 - `package.json` and `wrangler.jsonc` are the sources of truth for local commands and Worker runtime configuration.
+- `.github/workflows/ci.yml` validates pull requests and `main`; Cloudflare Workers Builds owns production and preview deployments through the repository's Git integration.
 - `tools/check_slug_only_docs.sh` is the documentation guard for the slug-only route contract.
 - Keep repository-wide rules here. Put directory-specific rules in a nested `AGENTS.md` only when a directory gains constraints that do not apply elsewhere.
 
@@ -79,6 +80,7 @@
 - `pnpm build` runs the Wrangler dry-run build and is required for runtime or deployment-related changes.
 - `pnpm exec tsc --noEmit` is useful for TypeScript-only changes when a focused type check is sufficient.
 - `bash tools/check_slug_only_docs.sh` is required after changing `README.md`, `AGENTS.md`, or route documentation.
+- GitHub Actions is validation-only. Do not add Cloudflare credentials or Worker deployment steps to repository workflows; production and branch-preview deployment belong to Cloudflare Workers Builds.
 - Before committing, run `git diff --check`, inspect the staged diff, and stage only files owned by the task.
 - For implementation work, commit verified task-owned changes with a concise message. Do not push, amend, rewrite history, deploy, or publish without an explicit request.
 
diff --git a/README.md b/README.md
index 27a1a2b..6c7c293 100644
--- a/README.md
+++ b/README.md
@@ -87,7 +87,7 @@ curl -s -D - -o /dev/null -H 'If-None-Match: "<etag from step 2>"' \
 
 ## Maintainer Note
 
-For local development and runtime configuration, use the repository scripts and `wrangler.jsonc` as the source of truth. This README is intentionally user-focused and omits internal deployment and CI details.
+For local development and runtime configuration, use the repository scripts and `wrangler.jsonc` as the source of truth. GitHub Actions validates changes; production and branch-preview deployments are owned by Cloudflare Workers Builds through the repository's Git integration.
 
 ## License & Content Ownership